JUNOHUB-test/.github/workflows/deploy-ec2.yml

name: build-deploy-junohub-ec2

env:
  IMAGE_NAME: junohub-app
  CONTAINER_NAME: junohub-app
  # Directory on the EC2 instance where app + compose live
  REMOTE_DIR: /junohub

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths-ignore:
      - '*.md'
      - '.gitignore'
      - 'docs/**'
      - 'README.md'

jobs:
  build-app:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build application image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          tags: ${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Save application image
        run: |
          docker save -o junohub-app_latest.tar ${{ env.IMAGE_NAME }}:latest
          echo "✅ Saved application image"          

      - name: Upload application image
        uses: actions/upload-artifact@v4
        with:
          name: app-image
          path: junohub-app_latest.tar

  deploy:
    runs-on: ubuntu-22.04
    needs: [build-app]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download application image
        uses: actions/download-artifact@v4
        with:
          name: app-image
          path: docker

      - name: Verify image tar
        run: |
          if [ ! -f docker/junohub-app_latest.tar ]; then
            echo "ERROR: Application image tar missing after download"
            ls -la docker/ || true
            exit 1
          fi
          echo "✅ Application image tar ready for deploy"          

      - name: Set up environment file
        run: |
          # Base env for production container
          echo "IMAGE_NAME=${{ env.IMAGE_NAME }}" > .env
          echo "CONTAINER_NAME=${{ env.CONTAINER_NAME }}" >> .env
          echo "NODE_ENV=production" >> .env

          # Append project-specific environment from EC2_ENV secret
          # EC2_ENV should contain additional KEY=VALUE lines
          echo "${{ secrets.EC2_ENV }}" >> .env

          echo "Environment file created (sensitive values masked):"
          cat .env | sed 's/\(PASS\|SECRET\|KEY\|TOKEN\|DATABASE_URL\)=.*/\1=***MASKED***/g' || true          

      - name: Setup SSH
        run: |
          # Set up the SSH key from GitHub Secrets
          echo "${{ secrets.EC2_SSH_KEY }}" | tr -d '\r' > ssh_key.pem
          chmod 400 ssh_key.pem          

      - name: Setup directories on server
        run: |
          ssh -i ssh_key.pem -o StrictHostKeyChecking=no ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'ENDSSH'
          # Create directory for docker-compose file, .env and image tar
          mkdir -p ${{ env.REMOTE_DIR }}
          echo "✅ Remote directory ensured at ${{ env.REMOTE_DIR }}"
          ENDSSH          

      - name: Copy deployment files to server
        run: |
          # Copy docker-compose (app + Postgres), and .env
          scp -i ssh_key.pem -o StrictHostKeyChecking=no docker-compose.yml ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/
          scp -i ssh_key.pem -o StrictHostKeyChecking=no .env ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/

          # Copy application image tar
          echo "Copying Docker image to server..."
          scp -i ssh_key.pem -o StrictHostKeyChecking=no docker/junohub-app_latest.tar ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/
          echo "✅ Successfully copied Docker image to server"          

      - name: Deploy with rolling update
        run: |
          ssh -i ssh_key.pem -o StrictHostKeyChecking=no ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'ENDSSH'
          set -e
          cd ${{ env.REMOTE_DIR }}

          # Basic disk space check (do not touch volumes)
          echo "=== DISK SPACE CHECK ==="
          df -h
          AVAILABLE_SPACE=\$(df -BG / | tail -1 | awk '{print \$4}' | sed 's/G//')
          if [ "\$AVAILABLE_SPACE" -lt 5 ]; then
            echo "⚠️  Low disk space: \${AVAILABLE_SPACE}GB available. Cleaning up dangling images..."
            docker system prune -af --volumes=false || true
            docker image prune -af || true
            df -h
          fi

          # Verify Docker image tar exists
          if [ ! -f junohub-app_latest.tar ]; then
            echo "ERROR: No application image tar found. Cannot deploy without pre-built image."
            exit 1
          fi

          echo "=== LOADING APPLICATION DOCKER IMAGE ==="
          docker load -i junohub-app_latest.tar
          rm -f junohub-app_latest.tar
          echo "✅ Application image loaded"

          # Rolling update with docker compose (app + Postgres)
          echo "=== ROLLING UPDATE (docker compose up -d) ==="
          if ! docker compose -f docker-compose.yml --env-file .env up -d --remove-orphans; then
            echo "ERROR: Deployment failed"
            docker compose -f docker-compose.yml down || true
            exit 1
          fi

          echo "✅ Deployment successful! Current services:"
          docker compose -f docker-compose.yml --env-file .env ps

          # Final cleanup (preserve volumes; prune dangling images only)
          docker system prune -f --volumes=false || true
          ENDSSH          

      - name: Local cleanup
        if: always()
        run: |
          rm -f ssh_key.pem
          rm -f .env
          rm -f docker/*.tar || true
          docker system prune -f || true